How ready is your hospital for India's data protection law?
A free self-check for clinics, nursing homes and hospitals up to about 200 beds. Answer plain-language questions about how you handle patient information, from the registration desk to the lab, the TPA desk and the CCTV room. You get a readiness score under the Digital Personal Data Protection Act, 2023 and Rules, 2025, the gaps that matter most, and a phased action list.
What the check covers
- Registration and consent
Notices, optional uses, withdrawals, emergencies - Children and guardians
Paediatric data beyond treatment, ad tracking - Lab, imaging and reports
Report delivery, outsourced labs, PACS - Insurers, TPAs and ABDM
Claim documents, ABHA consent flow - Telemedicine and WhatsApp
Teleconsults, patient messaging, opt-outs - CCTV, vendors and security
Camera placement, contracts, logins, backups - Breach response
72-hour Board report, 6-hour CERT-In report - Rights and retention
Patient requests, record-keeping periods, research
What this tool is. It describes what the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 say, based on the officially notified text, and asks how your hospital works today. It does not interpret the law for your situation or give a legal opinion. For that, please consult a qualified advocate.
Your answers stay in this browser on this device. Nothing is sent anywhere. Please do not enter any patient details in this tool.
Most DPDP duties for hospitals start on 13 May 2027, 18 months after the Rules were notified on 13 November 2025. Items marked DPDP requirement show what to prepare; they are not breaches today. Items marked Already in force come from other laws that apply now.
Tell us what services you run
This decides which questions apply to you. Questions about services you don't run are left out of the score.
This check is designed for hospitals up to about 200 beds. Larger hospitals usually need a full assessment, and may later be notified as Significant Data Fiduciaries with extra duties.
You haven't answered any questions yet.
Bands are indicators set by this tool, not a government standard. A score is never a pass, fail or certificate. Starting 0–39 · Developing 40–69 · Progressing 70–84 · Stronger readiness 85–100. “Not sure” counts as 0: if nobody can confirm a control, treat it as missing.
Three sides of readiness
days until the main DPDP duties start on 13 May 2027. Hospitals typically need 6–12 months to fix notices, vendor contracts and HIS access controls, so the useful window to start is now.
Critical findings
These items carry the highest risk for patients or the largest penalties, whatever your overall score.
Score by area
Left out of the score
All your answers
| # | Question | Answer | Type |
|---|
What to fix, in what order
Built from your answers. Tick items as you finish them; ticks are kept in this browser. Suggested owners are typical for a small or mid-size hospital, so adjust them to your team.
No gaps to show yet. Answer the questions first, or try the demo hospital.
Want help closing these gaps?
1flo helps hospitals put DPDP readiness in place: patient notices and consent flows, vendor addenda, HIS access reviews, secure WhatsApp patient messaging and breach drills. Mention “Hospital Privacy Compass” when you get in touch. Your answers are not shared unless you send them yourself.
How this check works
Content last checked against the notified DPDP Act, 2023 and DPDP Rules, 2025 on 17 October 2026. Government notifications, FAQs and Data Protection Board guidance issued after this date may change what applies.
Scoring
- Implemented = 1 point, Partly = ½, Not yet and Not sure = 0.
- Critical items count double. There are 8: children's data, sensitive-service records, CCTV placement, patient lists on ad platforms, backups, breach plan and CERT-In reporting.
- Questions about services you said you don't run are left out of the score.
- Coverage is the share of applicable questions answered with something other than “Not sure”.
- Each question carries one label: DPDP requirement (preparedness; duty starts 13 May 2027), Already in force (other laws that apply today) or Recommended practice (not a legal duty on its own, but needed to meet the duties).
Key dates
| Date | What starts |
|---|---|
| 13 Nov 2025 | DPDP Rules notified; Data Protection Board provisions (Rules 1, 2, 17–21) in force |
| 13 Nov 2026 | Consent Manager registration (Rule 4) |
| 13 May 2027 | Most duties for hospitals: notices, security safeguards, breach reporting, retention, children's data, rights (Rules 3, 5–16, 22, 23) |
Maximum penalties under the Act
| Failure | Up to |
|---|---|
| Reasonable security safeguards to prevent a breach | ₹250 crore |
| Notifying the Board and affected people of a breach | ₹200 crore |
| Additional obligations for children's data | ₹200 crore |
| Significant Data Fiduciary obligations | ₹150 crore |
| Any other provision of the Act or Rules | ₹50 crore |
The Board decides the amount case by case, considering the nature, gravity and duration of the breach and the steps taken to reduce harm.
Sources the questions draw on
- Digital Personal Data Protection Act, 2023: sections 3, 4–9, 11–14, 17 and the Schedule.
- Digital Personal Data Protection Rules, 2025 (notified 13 Nov 2025): Rules 3, 6, 7, 8, 9, 10, 11, 12 with the Fourth Schedule, 14 and 16.
- CERT-In Directions under section 70B(6) of the IT Act, 28 April 2022: 6-hour incident reporting and 180-day log retention.
- Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations, 2002, regulation 1.3: medical record retention and copies.
- Telemedicine Practice Guidelines, 2020.
- ABDM Health Data Management Policy (National Health Authority).
- Mental Healthcare Act, 2017; HIV and AIDS (Prevention and Control) Act, 2017; PC&PNDT Act, 1994; MTP Act, 1971; ART (Regulation) Act, 2021.
- ICMR National Ethical Guidelines for Biomedical and Health Research, 2017.
The DPDP Act covers personal data in digital form, and paper records once they are scanned or entered into a system. Paper-only records stay under medical-records rules and good practice.
Back up or move your answers
Copy a backup code to keep your answers, or paste one to restore them on another device.
Spotted an error? Tell us
If a question, reference or date looks wrong or out of date, send us the question number and what you think should change. We review every report and update the tool.
What this tool is. It describes what the DPDP Act and Rules say, based on the officially notified text. It does not interpret the law for your hospital's situation or give a legal opinion. Where a question needs interpretation, please consult a qualified advocate.
Prepared by 1flo (OneFlo System Integrators LLP), Hyderabad. The legal references in this tool are for awareness. They have not been reviewed by an independent lawyer. Check with your own legal adviser before acting. Pack: Hospital Privacy Compass v0.1-draft.